“It took a bit of work, but I found a variant that can leak about 30 kb per core, per second. This is fast enough to monitor encryption keys and passwords as users login!”
Every Zen 2 chip is affected, from Ryzen 3000 desktops to EPYC Rome servers, on every operating system. The leak comes from a mispredicted vzeroupper and the vector registers that strlen and friends use for routine string work. Ormandy found it with a fuzzer and reported it to AMD on May 15. AMD’s own post-silicon validation runs the same kind of testing, and it shipped the bug anyway.